Resource exhaustion in containerd - CVE-2023-25153

Vulnerability identifier: #VU72319

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-25153

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when importing an OCI image. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

containerd
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
ObjectScale
DB2 Data Management Console
DB2 Data Management Console on CPD
Dell EMC Streaming Data Platform
IBM Watson Machine Learning Accelerator
IBM Cloud Pak for Watson AIOps
DB2 on Cloud Pak for Data
Robotic Process Automation for Cloud Pak
IBM Cloud Pak for Security
IBM Cloud Transformation Advisor
IBM Watson Assistant for IBM Cloud Pak for Data
IBM MQ Operator
IBM Match 360
IBM Decision Optimization for Cloud Pak for Data
IBM Cloud Pak for Data Scheduling
Data Replication on Cloud Pak for Data
Amazon Linux AMI
Gentoo Linux
Ubuntu
openEuler
Fedora
QRadar Suite
IBM Edge Application Manager
containerd (Ubuntu package)
stargz-snapshotter
thrift (Red Hat package)
ansible-collection-ansible-posix (Red Hat package)
containerd
libunwind (Red Hat package)
app-containers/containerd
liborc (Red Hat package)
nvml (Red Hat package)
oath-toolkit (Red Hat package)
gperftools (Red Hat package)
lttng-ust (Red Hat package)
protobuf (Red Hat package)
ansible-collection-community-general (Red Hat package)
cephadm-ansible (Red Hat package)
libarrow (Red Hat package)
ceph (Red Hat package)
re2 (Red Hat package)
Cloud Pak for Data
OpenShift Virtualization
Red Hat Ceph Storage
IBM InfoSphere Information Server

Install updates from vendor's website.

containerd - addressed in versions 1.5.18, 1.6.18
ObjectScale - update to 1.3.0
QRadar Suite - update to 1.10.19.0
IBM Cloud Transformation Advisor - update to 3.10.2
DB2 Data Management Console - update to 3.1.13.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
DB2 Data Management Console on CPD - update to 4.7.2
containerd (Ubuntu package) - addressed in versions Ubuntu Pro, 1.6.12-0ubuntu1~20.04.3, 1.6.12-0ubuntu1~22.04.3, 1.6.12-0ubuntu1~22.10.2, 1.6.12-0ubuntu3.1
stargz-snapshotter - addressed in versions 0.14.2-1.fc37, 0.14.2-1.fc38
thrift (Red Hat package) - addressed in versions 0.15.0-3.el9cp, 0.20.0-4.el10cp
ansible-collection-ansible-posix (Red Hat package) - addressed in versions 1.2.0-1.3.el9ost, 2.0.0-1.el10cp
containerd - update to 1.2.0-209
libunwind (Red Hat package) - addressed in versions 1.6.2-2.el9cp, 1.8.0-4.el10cp
app-containers/containerd - update to 1.6.19
containerd - update to 1.6.19-1
containerd - addressed in versions 1.6.19-1.fc36, 1.6.19-1.fc37, 1.6.19-1.fc38, 1.6.23-1.fc37, 1.6.23-1.fc38
Dell EMC Streaming Data Platform - update to 1.7.0
liborc (Red Hat package) - update to 2.0.3-2.el10cp
IBM MQ Operator - addressed in versions 2.0.17, 3.0.0
nvml (Red Hat package) - update to 2.1.0-3.el10cp
oath-toolkit (Red Hat package) - addressed in versions 2.6.12-1.el9cp, 2.6.12-1.el10cp
gperftools (Red Hat package) - addressed in versions 2.9.1-5.el9cp, 2.9.1-5.el10cp
lttng-ust (Red Hat package) - update to 2.13.7-5.el10cp
protobuf (Red Hat package) - update to 3.19.6-12.el10
IBM Watson Machine Learning Accelerator - update to 4.0
ansible-collection-community-general (Red Hat package) - addressed in versions 4.0.0-1.1.el9ost, 10.7.3-1.el10cp
IBM Cloud Pak for Watson AIOps - update to 4.1.1
cephadm-ansible (Red Hat package) - addressed in versions 4.1.4-1.el9cp, 4.1.4-1.el10cp
IBM Match 360 - update to 4.7.0
IBM Decision Optimization for Cloud Pak for Data - update to 4.8
IBM Cloud Pak for Data Scheduling - update to 4.8.0
Data Replication on Cloud Pak for Data - update to 4.8.0
DB2 on Cloud Pak for Data - update to 4.8.4
Cloud Pak for Data - update to 4.8.5
OpenShift Virtualization - update to 4.14.0
Red Hat Ceph Storage - update to 9.0
libarrow (Red Hat package) - addressed in versions 9.0.0-10.el9cp, 15.0.2-3.el10cp
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
ceph (Red Hat package) - addressed in versions 20.1.0-144.el9cp, 20.1.0-144.el10cp
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.6, 23.0.6
re2 (Red Hat package) - addressed in versions 20211101-4.el9cp, 20211101-4.el10cp

• https://github.com/containerd/containerd/releases/tag/v1.6.18
• https://github.com/containerd/containerd/security/advisories/GHSA-259w-8hf6-59c2
• https://github.com/containerd/containerd/releases/tag/v1.5.18

• Multiple vulnerabilities in containerd
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Edge Application Manager
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Ubuntu update for containerd
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in Dell Streaming Data Platform
• Multiple vulnerabilities in ICP Match 360
• Multiple vulnerabilities in Dell Data Protection Central
• Fedora 37 update for containerd
• Fedora 36 update for containerd
• Fedora 38 update for containerd
• Fedora 37 update for stargz-snapshotter
• Fedora 38 update for stargz-snapshotter
• Fedora 38 update for containerd
• Fedora 37 update for containerd
• Multiple vulnerabilities in OpenShift Virtualization
• Multiple vulnerabilities in IBM Cloud Pak for Data Scheduling
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM QRadar Suite Software
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• openEuler update for containerd
• Multiple vulnerabilities in Data Replication on Cloud Pak for Data
• Multiple vulnerabilities in IBM Db2 on Cloud Pak for Data
• Gentoo update for containerd
• Amazon Linux AMI update for containerd
• Multiple vulnerabilities in IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in IBM DB2 Data Management Console
• Multiple vulnerabilities in Red Hat Ceph Storage 9